A critical deserialization vulnerability in Tencent HunyuanDiT allows unauthenticated remote attackers to achieve arbitrary code execution in the context of the root user.

This flaw exists in the model_resume function, where improper validation of user-supplied data leads to deserialization of untrusted data. While user interaction is required, successful exploitation allows an attacker to execute arbitrary code with root privileges.

The potential for remote code execution with root-level privileges poses a severe risk to the confidentiality, integrity, and availability of the host system. Given the CVSS score of 7.8, this vulnerability represents a high-risk entry point that could lead to full system compromise, lateral movement within the network, and long-term persistence by an attacker.

Immediate Action: Review the provided commit reference (d2cb9cde5c9dc6a6c01735dcb92fe7699ddf6bc5) and apply the upstream fix to the HunyuanDiT codebase immediately.

Proactive Monitoring: Monitor system logs for unexpected process execution or unauthorized file modifications originating from the model_resume function or associated model loading workflows.

Compensating Controls: Restrict access to environments running HunyuanDiT and enforce strict input validation or sandboxing for any files processed by the model_resume function to mitigate the risk of malicious payloads.

Public Exploit Available: Unknown

Organizations utilizing the Tencent HunyuanDiT model should prioritize the application of the upstream fix identified in the official repository. Given the high severity of remote code execution, failure to patch these instances could result in a total system takeover. Please ensure that all development and production environments are updated to a version containing the identified commit.